gentimes

Description

Generates timestamp results starting with the exact time specified as start time. Each result describes an adjacent, non-overlapping time range as indicated by the increment value. This terminates when enough results are generated to pass the endtime value.

Comments

Woodcock - As stated in the increments, only seconds, minutes, hours, and days are supported. Weeks have never been supported. However to get weeks, you can use "increment=7d".

Lstewart splunk, Splunker

April 30, 2018

On some (all?) versions of Splunk, "increment=1w" does not work (does the same thing as "increment=1d") and that should be fixed. When that is fixed, "increment=7d" should also be fixed so that the difference between "increment=7d" and "increment=1w" should be that the former's events have "endtime" values 1 day later than "starttime" and the latter should have "endtime" values 1 week later than "startttime"; otherwise they should be the same. It seems to me that the right thing to do is always use the "s/m/h/d/w" value to determine what the span from "starttime" to "endtime" should be in every case.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »